MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1
SHA3-384 hash: 90c212987ed656b1bd9dcbd2904cbc433c845f6033831828d1be973214f026bc094808aea7a4add2cb3e57548f04b285
SHA1 hash: 602c176845cf62ca63ae4e810d92f846b6e3ea9f
MD5 hash: 35500ebe0ae0de7b2c4982759f4487be
humanhash: potato-friend-april-video
File name:35500ebe0ae0de7b2c4982759f4487be.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:454'112 bytes
First seen:2020-11-23 16:11:40 UTC
Last seen:2020-11-23 18:20:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:dCudnO72JZZsHrZa6Igy5RgK/MR/D2lDeDiXAR3AMAO7qZYEqb7d9zeG3Pu4mG8r:dCudOjhbUO3AQvO4xE
Threatray 3'001 similar samples on MalwareBazaar
TLSH 57A4AE017BFD2829F9F31BB87D7994174CBABDA92D15C87D19A406CE447AE004E62B33
Reporter abuse_ch
Tags:exe FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Creating a process with a hidden window
DNS request
Unauthorized injection to a recently created process
Creating a file
Launching cmd.exe command interpreter
Sending an HTTP GET request
Sending a TCP request to an infection source
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/545347
Signature
Connects to a pastebin service (likely for C&C)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321763 Sample: CSq58hA6nO.exe Startdate: 23/11/2020 Architecture: WINDOWS Score: 100 39 www.crimson.school 2->39 41 www.620harbourdrive.com 2->41 43 2 other IPs or domains 2->43 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Malicious sample detected (through community Yara rule) 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 2 other signatures 2->69 11 CSq58hA6nO.exe 15 3 2->11         started        signatures3 process4 dnsIp5 51 hastebin.com 172.67.143.180, 443, 49713 CLOUDFLARENETUS United States 11->51 37 C:\Users\user\AppData\...\CSq58hA6nO.exe.log, ASCII 11->37 dropped 73 Tries to detect virtualization through RDTSC time measurements 11->73 16 CSq58hA6nO.exe 11->16         started        19 timeout.exe 1 11->19         started        21 CSq58hA6nO.exe 11->21         started        file6 signatures7 process8 signatures9 55 Modifies the context of a thread in another process (thread injection) 16->55 57 Maps a DLL or memory area into another process 16->57 59 Sample uses process hollowing technique 16->59 61 Queues an APC in another process (thread injection) 16->61 23 explorer.exe 16->23 injected 27 conhost.exe 19->27         started        process10 dnsIp11 45 www.sabaicraft.com 192.64.147.164, 49755, 80 VOODOO1US United States 23->45 47 autowarrantyworld.net 162.0.232.161, 49748, 80 NAMECHEAP-NETUS Canada 23->47 49 12 other IPs or domains 23->49 71 System process connects to network (likely due to code injection or exploit) 23->71 29 explorer.exe 12 23->29         started        signatures12 process13 dnsIp14 53 www.sz360buy.com 29->53 75 System process connects to network (likely due to code injection or exploit) 29->75 77 Modifies the context of a thread in another process (thread injection) 29->77 79 Maps a DLL or memory area into another process 29->79 81 Tries to detect virtualization through RDTSC time measurements 29->81 33 cmd.exe 1 29->33         started        signatures15 process16 process17 35 conhost.exe 33->35         started       
Detection:
formbook
Create hunting rule
Link:
https://mwdb.cert.pl/sample/907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 16:12:06 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
048a4bdb5c21a62e9028370b06b2804aaeb3b85b2446f5c47ff3fb3e7f676be8
Formbook
321330f837123bfa71b5fba50ba33848c6060c72242e7cbfa37981f3e834719b
Formbook
543297a97a78b4347302bded28c19777fc5a7771f5c20b8042cbac3e0baadfec
Formbook
59be3e15ddff51758d23796f5528e93ff6c5164486bd0416ff25dc0ddc33f29c
Formbook
6499e8029a2f0db6a6a601d425217cd6bf076fe96accdce24fe042b24001bc8f
Formbook
69357684ec8f83d428d2030db5f3d586718207e86457465e7fd37b3b4b7c4db2
Formbook
79fe9749c4a7e8297e056cc4f0fbed7130900cd9aa2be3a1339acde4a11ca171
Formbook
c2ed9a707bd10d4d9d9291d1fd7bc7316d8a80f846b6263c800ff89885641e37
Formbook
ed6182df3469dfdc4084aea0aca3714a90498401d608c7a0ab818329c42ab21f
Formbook
f78a1ebc98a1c1482564cc64a7d10ba7c1ed03591b8cebeba72f27df590dd57d
Formbook
+ 2'991 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201123-83w5ep3l8e/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.teelinkz.com/o56q/
Unpacked files
SH256 hash:
907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1
MD5 hash:
35500ebe0ae0de7b2c4982759f4487be
SHA1 hash:
602c176845cf62ca63ae4e810d92f846b6e3ea9f
Link:
https://www.unpac.me/results/e41a8af3-2f9b-4a0e-91d0-ba3433dc09e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Password Stealer
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Formbook

Executable exe 907ce816005834ccfbfc0ea29519e493dee2ae1f141e72f2971eadfc7c6893b1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/836467/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/105325/

Comments